US11442757B2 - Simulation method and simulation system - Google Patents

Simulation method and simulation system Download PDF

Info

Publication number
US11442757B2
US11442757B2 US17/079,530 US202017079530A US11442757B2 US 11442757 B2 US11442757 B2 US 11442757B2 US 202017079530 A US202017079530 A US 202017079530A US 11442757 B2 US11442757 B2 US 11442757B2
Authority
US
United States
Prior art keywords
speculation
processor
model
branch
fetch
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US17/079,530
Other languages
English (en)
Other versions
US20210247991A1 (en
Inventor
Junshi Wang
Meng Wang
Zheng Wang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Zhaoxin Semiconductor Co Ltd
Original Assignee
Shanghai Zhaoxin Semiconductor Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Zhaoxin Semiconductor Co Ltd filed Critical Shanghai Zhaoxin Semiconductor Co Ltd
Assigned to SHANGHAI ZHAOXIN SEMICONDUCTOR CO., LTD. reassignment SHANGHAI ZHAOXIN SEMICONDUCTOR CO., LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: WANG, JUNSHI, WANG, MENG, WANG, ZHENG
Publication of US20210247991A1 publication Critical patent/US20210247991A1/en
Application granted granted Critical
Publication of US11442757B2 publication Critical patent/US11442757B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
    • G06F9/45508—Runtime interpretation or emulation, e g. emulator loops, bytecode interpretation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/3004—Arrangements for executing specific machine instructions to perform operations on memory
    • G06F9/30047—Prefetch instructions; cache control instructions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30145—Instruction analysis, e.g. decoding, instruction word fields
    • G06F9/3016—Decoding the operand specifier, e.g. specifier format
    • G06F9/30167—Decoding the operand specifier, e.g. specifier format of immediate specifier, e.g. constants
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3802—Instruction prefetching
    • G06F9/3804—Instruction prefetching for branches, e.g. hedging, branch folding
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
    • G06F9/3842—Speculative instruction execution
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3867—Concurrent instruction execution, e.g. pipeline or look ahead using instruction pipelines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45504—Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
    • G06F9/45516—Runtime code conversion or optimisation
    • G06F9/4552—Involving translation to a different instruction set architecture, e.g. just-in-time translation in a JVM
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/461—Saving or restoring of program or task context
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30098—Register arrangements
    • G06F9/3012—Organisation of register space, e.g. banked or distributed register file
    • G06F9/30123—Organisation of register space, e.g. banked or distributed register file according to context, e.g. thread buffers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/3017—Runtime instruction translation, e.g. macros
    • G06F9/30174—Runtime instruction translation, e.g. macros for non-native instruction set, e.g. Javabyte, legacy code
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30181—Instruction operation extension or modification
    • G06F9/30189—Instruction operation extension or modification according to execution mode, e.g. mode flag
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30181—Instruction operation extension or modification
    • G06F9/30196—Instruction operation extension or modification using decoder, e.g. decoder per instruction set, adaptable or programmable decoders
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
    • G06F9/3842—Speculative instruction execution
    • G06F9/3844—Speculative instruction execution using dynamic branch prediction, e.g. using branch history tables
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45554—Instruction set architectures of guest OS and hypervisor or native processor differ, e.g. Bochs or VirtualPC on PowerPC MacOS
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects

Definitions

  • the invention relates to a central processing unit (CPU) modeling technology, and more particularly, relates to a simulation method and a simulation system based on a just-in-time (JIT) emulation engine.
  • CPU central processing unit
  • JIT just-in-time
  • speculative execution is a very important technical means to improve message execution efficiency.
  • a typical representative is the prediction of branch instructions.
  • the CPU predicts directions and target addresses of the branch instructions to be executed in the future by collecting a jump history of the branch instructions. If the prediction is correct, an instruction throughput of the CPU can be significantly improved.
  • By modeling and simulating speculative execution behavior the number of speculation occurrences in the CPU architecture and the impact of speculative execution on CPU performance can be optimized, providing a reference for CPU hardware design.
  • the static analysis method cannot obtain the best analysis results.
  • Executing the software directly on the hardware is difficult to achieve accurate quantitative analysis due to the limitations of the debugging means (e.g., a performance counter) provided by the hardware platform.
  • the debugging means e.g., a performance counter
  • JIT emulation engine is a very effective CPU modeling and emulation technology, and the secondary development cost is relatively small. Its main feature is that by instrumenting and converting the assembly of a to-be-run application, the to-be-run application is converted into a code that can be run directly on a physical machine and can obtain a running environment of the application, which may then be directly run on the physical machine. The status the JIT emulation engine obtains before and after the instruction execution does not come from the virtual environment maintained by the JIT emulation engine itself, but from the actual environment in which a processor runs.
  • the JIT emulation engine does not need a huge number of instruction decoding and execution units, but the instruction decoding and executing is performed by a physical machine instead to provide very fast emulation speed.
  • developing a emulator based on the JIT emulation engine can well divide the modules. After the development of each module is completed, the complete application can be run with the support of the JIT emulation engine to well avoid the problem of excessive one-time development tasks.
  • the shortcoming of the JIT emulation engine is that the JIT emulation engine shields internal implementation details of the CPU and can only output the CPU's architectural status information, including registers and memories. Therefore, the JIT emulation engine needs to be used in conjunction with the CPU model.
  • the JIT emulation engine provides the results of instruction execution while the CPU model provides the internal details of the CPU operation.
  • the instructions executed by the JIT emulation engine will modify the application execution environment and cannot be undone. This limits the JIT emulation engine's ability to model the speculative execution. None of the currently popular emulators based on the JIT emulation engine can support speculative execution and could only execute instructions on the correct instruction stream. A more accurate emulator can reflect the impact of speculative execution on instruction latency and throughput by increasing the penalty, but cannot reflect the impact of speculative execution on the internal state of the CPU such as branch prediction tables and caches.
  • the invention provides a simulation method adapted to a simulation system including an execution model and a processor model.
  • the method includes: simulating a target processor by the processor model to generate a plurality of first branch prediction information associated with a first branch instruction; receiving a first fetch start message from the processor model by the execution model, wherein the first fetch start message comprises a first fetch address; calling a real-time emulation engine by the execution model to control a physical machine to fetch and execute the first branch instruction according to the first fetch address; obtaining a plurality of first branch instruction information of the first branch instruction from the real-time emulation engine and providing the plurality of first branch instruction information to the processor model by the execution model; and in response to determining that the plurality of first branch prediction information do not exactly match the plurality of first branch instruction information, recording a first processor status of the physical machine and enforcing the real-time emulation engine to execute a first speculation operation according to the plurality of first branch prediction information by the execution model.
  • the invention provides a simulation system, which includes an execution model and a processor model.
  • the processor model simulates a target processor to generate a plurality of first branch prediction information associated with a first branch instruction.
  • the execution model receives a first fetch start message from the processor model, wherein the first fetch start message comprises a first fetch address.
  • the execution model calls a real-time emulation engine to control a physical machine to fetch and execute the first branch instruction according to the first fetch address.
  • the execution model obtains a plurality of first branch instruction information of the first branch instruction from the real-time emulation engine and provides the plurality of first branch instruction information to the processor model.
  • the execution model In response to determining that the plurality of first branch prediction information do not exactly match the plurality of first branch instruction information, the execution model records a first processor status of the physical machine and enforces the real-time emulation engine to execute a first speculation operation according to the plurality of first branch prediction information.
  • the simulation method and simulation system based on JIT proposed by the invention have the ability to model and simulate speculative execution.
  • an emulator based on a JIT emulation engine can also simulate the process of speculation.
  • the JIT emulation engine can execute instructions on a speculation operation path and obtain influence of a speculation instruction on an architectural status environment later.
  • the JIT emulation engine can adjust the architectural status to a status before the speculation is started, and begin to execute the instructions on the correct path.
  • FIG. 1 is a system architecture diagram illustrated according to an embodiment of the invention.
  • FIG. 2 is a flowchart of a simulation method illustrated according to an embodiment of the invention.
  • FIG. 3 is a schematic diagram of a speculation stack illustrated according to an embodiment of the invention.
  • FIG. 4 is a schematic diagram of a simulation system interaction illustrated according to an embodiment of the invention.
  • FIG. 5 is a schematic diagram of a state switching of the execution model illustrated according to an embodiment of the invention.
  • FIG. 6 is a timing diagram of a state switching of the execution model illustrated according to FIG. 5 .
  • the invention proposes a simulation method and a simulation system based on JIT that can support speculative execution.
  • an emulator based on the JIT emulation engine is also able to simulate the process of speculation.
  • the JIT emulation engine can execute instructions on a speculation operation path and obtain influence of a speculation instruction on an architectural status environment later.
  • the JIT emulation engine can adjust the architectural status to a status before the speculation is started, and begin to execute the instructions on the correct path.
  • FIG. 1 is a system architecture diagram illustrated according to an embodiment of the invention.
  • a system 100 of the invention includes a simulation system 10 , a JIT emulation engine 13 and a physical machine 14 , wherein the simulation system 10 includes an execution model 11 and a processor model 12 .
  • the execution model 11 and the processor model 12 are, for example, two threads.
  • the execution model 11 may be used to call the JIT emulation engine 13 so that the JIT emulation engine 13 running a specific application can control the physical machine 14 (which is, for example, a computer device including a processor (e.g., CPU)) and obtain influence of instructions on a processor architecture status (e.g., how registers and/or memories are modified).
  • the processor model 12 may be used to simulate an internal running way of a target processor (e.g., CPU), so as to realize functions such as branch prediction, instruction execution by a simulation pipeline 121 and an instruction stream execution control.
  • the target processor can be a processor of any specific architecture and model (e.g., its architecture can be X86 architecture, ARM architecture and the like), and can simulate any processors, including but limited to: the target processor that needs to optimize its own hardware design, or the target processor that needs to optimize software for its existing hardware design (e.g., performance analysis and fine-tuning for the software running on the target processor).
  • the target processor can be a processor of any specific architecture and model (e.g., its architecture can be X86 architecture, ARM architecture and the like), and can simulate any processors, including but limited to: the target processor that needs to optimize its own hardware design, or the target processor that needs to optimize software for its existing hardware design (e.g., performance analysis and fine-tuning for the software running on the target processor).
  • the JIT emulation engine 13 may be considered as one processor exclusive to the execution model 11 . Further, although the JIT emulation engine 13 , the execution model 11 and the processor model 12 are all running on the physical machine 14 , the JIT emulation engine 13 hides an actual state of the physical machine 14 , and only provides a CPU status caused by the specific application running on the JIT emulation engine 13 to the execution model 11 . In addition, in the embodiment of the invention, the JIT emulation engine 13 may provide a result of running the specific application after the emulation operation is ended. The processor model 12 may provide results related to the processor structure, such as the number of instructions executed, the accuracy of branch prediction, the times of speculations and the like, but not limited thereto.
  • the execution model 11 and the processor model 12 may be configured to cooperatively execute the simulation method proposed by the invention, which is described in detail as follows.
  • FIG. 2 is a flowchart of a simulation method illustrated according to an embodiment of the invention.
  • the method of the present embodiment may be executed by the execution model 11 and the processor model 12 of FIG. 1 .
  • the details of each step in FIG. 2 are described below with reference to the content shown in FIG. 1 .
  • the processor model 12 simulates a target processor to generate a plurality of first branch prediction information associated with a first branch instruction.
  • the first branch instruction may be regarded as a branch instruction, but not limited thereto.
  • the first branch prediction information may include a first branch instruction prediction address, a first branch prediction direction, a first branch prediction target address and a predicted branch instruction length, but not limited thereto.
  • the first branch instruction prediction address refers to an address of the branch instruction itself (“jump” is taken herein as an example herein);
  • the first branch prediction direction refers to a jump direction of the first branch instruction (e.g., a branch taken or a branch not-taken) predicted by a branch prediction module in the processor model 12 ;
  • the first branch prediction target address refers a target address to which the first branch instruction intends to jump, as predicted by the branch prediction module in the processor model 12 .
  • instruction data with a size of 16 bytes may be fetched from a memory in one CPU cycle and these instruction data can be collectively referred to as one fetch unit.
  • the processor model 12 may also perform a simulated branch prediction function on a fetch unit (hereinafter, also referred to as a first fetch unit) in advance to generate branch prediction results (e.g., including the above mentioned first branch prediction information) for each branch instruction in the first fetch unit, but the invention is not limited thereto.
  • the execution model 11 may receive a first fetch start message from the processor model 12 , wherein the first fetch start message may include a first fetch address.
  • the first fetch start message may also include an emulation time.
  • the first fetch address is a starting fetch address of the first fetch unit.
  • step S 220 the execution model 11 may calls the JIT emulation engine 13 to control the physical machine 14 to fetch and execute the first branch instruction according to the first fetch address.
  • details regarding how the physical machine 14 fetches and executes the first branch instruction may refer to the existing methods for the CPU to fetch and execute instructions, ad thus details regarding the same is not repeated herein.
  • the execution model 11 may obtain a plurality of first branch instruction information of the first branch instruction from the JIT emulation engine 13 and provide the plurality of first branch instruction information to the processor model 12 .
  • the execution model 11 may obtain the first branch instruction information related to the first branch instruction executed by the JIT emulation engine 13 .
  • the first branch instruction information may include static instruction information and dynamic instruction information (e.g., operand values and the like).
  • the static instruction information may include a first branch instruction address, a first branch direction and a first branch target address which are associated with the first branch instruction, but not limited thereto.
  • the first branch instruction address, the first branch direction and the first branch target address can be understood as a branch instruction address, a branch direction and a branch target address correctly obtained when the first branch instruction is actually fetched and executed.
  • the first branch instruction prediction address e.g., the address of the branch instruction
  • the first branch prediction direction e.g., the branch taken or the branch not-taken
  • the first branch prediction target address i.e., the address to which the branch instruction intends to jump
  • the processor model 12 if a certain branch is not predicted by the processor model 12 , it means that the processor model 12 predicts that the instruction is the branch not-taken. That is to say, the address jump will not occur at that first branch instruction, but an instruction subsequent to the first branch instruction will be executed instead.
  • the processor model 12 may determine whether the first branch prediction information exactly match the first branch instruction information. Specifically, the processor model 12 may determine whether the first branch instruction prediction address, the first branch prediction direction and the first branch prediction target address do not exactly match the first branch instruction address, the first branch direction and the first branch target address, respectively. In short, the processor model 12 may compare its branch prediction result related to the first branch instruction with a correct execution result of the first branch instruction provided by the JIT emulation engine 13 and determine whether to enforce the JIT emulation engine 13 to perform a speculation operation.
  • the execution model 11 can continue to control the JIT emulation engine 13 to fetch and execute the instruction subsequent to the first branch instruction.
  • the subsequent instruction can be understood as an instruction next to the first branch instruction in a normal instruction stream, but not limited thereto.
  • the execution model 11 at the time can be understood as being switched to a continued fetch state (hereinafter referred to as a first continued fetch state) in a normal operation path (i.e., a non-speculation operation path).
  • the execution model 11 may maintain the continued fetch state in the normal operation path until each instruction in the first fetch unit has been fetched and simulated. In this case, the execution model 11 may switch from the continued fetch state (i.e., the first continued fetch state) in the normal operation path to a wait fetch state in the normal operation path (hereinafter referred to as a first wait fetch state).
  • the invention may enforce the JIT emulation engine 13 to perform the speculation operation through the following mechanism to obtain information that can be used to model the speculation operation.
  • step S 250 in response to determining that the first branch prediction information does not exactly match the first branch instruction information, the processor model 12 may send a first speculation start message to the execution model 11 .
  • step S 260 the execution model 11 may record a first processor status of the physical machine 14 in response to the first speculation start message and enforce the JIT emulation engine 13 to execute a first speculation operation according to the first branch prediction information.
  • the invention is not limited by determining whether to perform the speculation operation only with approach in the foregoing steps S 250 and S 260 .
  • the branch prediction information related to the first branch instruction and the correct execution result of the first branch instruction provided by the JIT emulation engine 13 are compared by the execution model 11 .
  • the processor model 12 may send the first branch prediction information predicted by itself together with the first instruction fetch start message to the execution model 11 for comparison in step S 210 described above.
  • the first speculation start message is not necessary.
  • the execution model 11 records the first processor status of the physical machine 14 and enforces the JIT emulation engine 13 to execute the first speculation operation according to the first branch prediction information.
  • the execution model 11 may include the speculation stack 111 , which is a first-in-last-out stack that can be used to record the first processor status of the physical machine 14 .
  • the first processor status may be provided by the JIT emulation engine 13 and includes a first current register status and a first memory snapshot of a processor of the physical machine 14 .
  • the execution model 11 may add a first speculation unit associated with the first speculation operation in the speculation stack 111 , wherein the first speculation unit records a first start speculation time of the first speculation operation, a first branch instruction address of the first branch instruction, the first current register status and the first memory snapshot.
  • the above operation can be understood as recording a current running scene of the processor of the physical machine 14 as the first speculation unit in advance before enforcing the JIT engine 13 to execute the first speculation operation.
  • the execution model 11 may further restore the processor of the physical machine 14 to a state before the first speculation operation is executed based on the first speculation unit.
  • the processor model 12 may accordingly output a related simulated speculation execution result associated with the target processor.
  • the processor model 12 may also output the related simulated speculation execution result (e.g., the number of executed instructions, the accuracy of branch prediction, the times of speculations and the like) for each speculation operation that occurs during execution as reference for relevant persons, but the invention is not limited to thereto.
  • the above-mentioned simulated speculation execution result may be collected by the processor model 12 based on state information such as the branch prediction tables/caches on each speculation operation path, and may be stored by the processor model 12 in the form of an archive.
  • the invention not only obtains influence of the instructions on the processor architecture state (e.g., how registers and/or memories are modified) by the JIT emulation engine 13 , but also the processor model 12 simulates the internal running way of the target processor to output the result related to the structure of the target processor (in particular, the simulated speculation execution result) so as to reflect influence of the speculative execution on an internal state of the target processor.
  • the processor model 12 simulates the internal running way of the target processor to output the result related to the structure of the target processor (in particular, the simulated speculation execution result) so as to reflect influence of the speculative execution on an internal state of the target processor.
  • the execution model 11 may also record the current running scene of the processor of the physical machine 14 as a second speculation unit before the second speculation operation is executed, and add the second speculation unit behind the first speculation unit. In this way, after the second speculation operation is ended, the execution model 11 may further restore the processor of the physical machine 14 to a state before the second speculation operation is executed based on the second speculation unit. Details regarding the above will be described later with reference to the drawings.
  • the execution model 11 may, for example, enforce the JIT emulation engine 13 to execute the first speculation operation according to the first branch instruction prediction address, the first branch prediction direction and the first branch prediction target address so as to enter the speculation operation path to execute the first speculation instruction stream.
  • the execution model 12 may switch from the continued fetch state (i.e., the first continued fetch state) in the normal operation path to a wait fetch state (hereinafter referred to as a second continued fetch state) in the speculation operation path. That is to say, the execution model 11 may also determine to continue fetching.
  • the execution model 11 at the time can be understood as switching from the continued fetch state (i.e., the first continued fetch state) in the normal operation path to the continued fetch state (i.e., the second first continued fetch state) in the speculation operation path.
  • the execution model 11 may further determine to stop fetching (i.e., cease fetching the next instruction from the first fetch unit), and send a first fetch end message to the processor model 12 .
  • the execution model 11 may switch from the continued fetch state (i.e., the first continued fetch state) in the normal operation path to a wait fetch state (hereinafter referred to as a second wait fetch state) in the speculation operation path.
  • the execution model 11 may switch from the wait fetch state (i.e., the second wait fetch state) in the speculation operation path to the continued fetch state (i.e., the second continued fetch state) in the speculation operation path.
  • the execution model 11 again returns to the wait fetch state (i.e., the second wait fetch state) in the speculation operation path from the continued fetch state (i.e., the second continued fetch state) in the speculation operation path.
  • the execution model 11 of the invention may switch from the continued fetch state (i.e., the second continued fetch state) in the speculation operation path to the wait fetch state (i.e., the second wait fetch state) in the speculation operation path.
  • the execution model 11 maintains at the continued fetch state (i.e., the second continued fetch state) in the speculation operation path.
  • the continued fetch state i.e., the second continued fetch state
  • the processor model 12 may determine whether to end the first speculation operation. For instance, the processor model 12 may determine whether the first branch instruction is completely executed in the simulation pipeline 121 on the processor model 12 . If so, the processor model 12 may determine that the first speculation operation needs to be ended, and flush the simulation pipeline 121 to cancel influence of the first branch instruction on the processor model 12 .
  • the processor model 12 may then determine that the first speculation operation needs to be ended at that time.
  • the processor model 12 may send a first speculation end message to the execution model 11 to control the execution model 11 to end the first speculation operation.
  • the execution model 11 may restore the physical machine 14 to the first processor status in response to the first speculation end message and control the JIT emulation engine 13 to obtain and execute an instruction subsequent to the first branch instruction.
  • the first speculation end message from the processor model 12 may include the first start speculation time of the first speculation operation, and the first branch instruction address of the first branch instruction. Therefore, after the first speculation end message is received, according to the first start speculation time and the first branch instruction address, the execution model 11 may find the first speculation unit corresponding to the first speculation operation (which records the first current register status and the first memory snapshot of the physical machine 14 before the first speculation operation is started) in the speculation stack 111 .
  • the execution model 11 may restore a register status of the processor of the physical machine 14 according to the first current register status. Further, the execution model may further discard the first speculation unit and other speculation units (if any) sorted after the first speculation unit to cancel influence of the first speculation operation on the memory. In this way, the execution model 11 may restore the processor of the physical machine 14 to a state before the first speculation operation is executed and continue to operate on the correct instruction stream.
  • the execution model 11 may use the JIT emulation engine 13 to control the physical machine 14 to fetch and execute the second branch instruction.
  • the second branch instruction may be another branch instruction in the first fetch unit.
  • the simulation system 10 of the invention may execute a similar operation after step S 240 of FIG. 2 based on the second branch instruction, but not limited thereto.
  • the second branch instruction may also be a branch instruction in another fetch unit (e.g., a second fetch unit).
  • the simulation system 10 of the invention may execute a similar operation after step S 210 of FIG. 2 based on the second branch instruction.
  • the processor model 12 may generate branch prediction information of each branch instruction in the first fetch unit in advance. If the second branch instruction and the first branch instruction both belong to the first fetch unit, the branch prediction information herein may also include branch prediction information related to the second branch instruction (hereinafter, referred to as second branch prediction information). Similar to the first branch prediction information, the second branch prediction information related to the second branch instruction may also include a second branch instruction prediction address, a second branch prediction direction and a second branch prediction target address.
  • the execution model 11 may obtain a plurality of second branch instruction information of the second branch instruction from the JIT emulation engine 13 and provide the plurality of second branch instruction information to the processor model 12 .
  • the second branch instruction information may also include static instruction information and dynamic instruction information (e.g., operand values and the like).
  • the static instruction information may include a second branch instruction address, a second branch direction and a second branch target address which are associated with the second branch instruction.
  • the second branch instruction address, the second branch direction and the second branch target address can be understood as a branch instruction address, a branch direction and a branch target address correctly obtained when the second branch instruction is fetched and executed.
  • the second branch instruction prediction address, the second branch prediction direction and the second branch prediction target address in the second branch prediction result can be understood as a prediction result obtained by the processor model 12 by simulating a branch predictor of the target processor.
  • the processor model 12 may determine whether the second branch prediction information exactly match the second branch instruction information. Specifically, the processor model 12 may determine whether the second branch instruction prediction address, the second branch prediction direction and the second branch prediction target address exactly match the second branch instruction address, the second branch direction and the second branch target address, respectively. In brief, the processor model 12 may compare its branch prediction result related to the second branch instruction with correct execution information of the second branch instruction provided by the JIT emulation engine 13 and determine whether to enforce the JIT emulation engine 13 to execute another speculation operation (e.g., the second speculation operation mentioned above) in the first speculation operation.
  • another speculation operation e.g., the second speculation operation mentioned above
  • the execution model 11 can continue to control the JIT emulation engine 13 to fetch and execute the instruction subsequent to the second instruction.
  • the invention may enforce the JIT emulation engine 13 to execute the second speculation operation through the following mechanism so as to obtain information that can be used to model the speculation operation.
  • the processor model 12 may send a second speculation start message to the execution model 11 .
  • the execution model 11 may record a second processor status of the processor of the physical machine 14 in response to the second speculation start message and enforce the JIT emulation engine 13 to execute the second speculation operation according to the second branch prediction information.
  • the second processor status may be provided by the JIT emulation engine 13 and may include a second current register status and a second memory snapshot of the processor of the physical machine 14 .
  • the second speculation operation can be understood as another speculation operation additionally occurred during the first speculation operation.
  • the first speculation unit corresponding to the first speculation operation should already be recorded in the speculation stack 111 , Accordingly, the execution model 11 may add the second speculation unit associated with the second speculation operation in the speculation stack 111 , wherein the second speculation unit records a second start speculation time of the second speculation operation, a second branch instruction address of the second branch instruction, the second current register status and the second memory snapshot.
  • the second memory snapshot further records memory pages modified after the first speculation operation is executed.
  • the execution model 11 may switch between the continued fetch state (i.e., the second continued fetch state) in the speculation operation path and the wait fetch state (i.e., the second wait fetch state) in the speculation operation path based on actual situation, but not limited thereto. For instance, in the case where the execution model 11 is in the second continued fetch state, if the considered fetch unit is completed or the branch taken is encountered, the execution model 11 may switch to the second wait fetch state. As another example, in the case where the execution model 11 is in the second continued fetch state, if the execution model 11 receives a fetch start message from the processor model 12 , the execution model 11 may then switch to the continued fetch state.
  • the disclosure is not limited in this regard.
  • the processor model 12 may send a second speculation end message to the execution model 11 to control the execution model 11 to control the JIT emulation engine 13 to end the second speculation operation.
  • the operation herein can be understood as returning to the path of the first speculation operation from the path of the second speculation operation so as to continue executing the first speculation operation.
  • the second speculation end message may include a second start speculation time and a second instruction address corresponding to the second speculation operation for the execution model 11 to find the second speculation unit corresponding to the second speculation operation in the speculation stack 111 accordingly.
  • the execution model 11 may restore the physical machine 14 to the second processor status in response to the second speculation end message and control the JIT emulation engine 13 to fetch and execute an instruction subsequent to the second instruction.
  • the execution model 11 at that time can be understood as maintaining at the continued fetch state (i.e., the second continued fetch state) in the speculation operation path.
  • the execution model 11 may find the second speculation unit corresponding to the second speculation operation from the speculation stack 111 according to the second start speculation time and the second instruction address, restore a register status of the processor of the physical machine 14 according to the second current register status recorded by the second speculation unit, and discard the second speculation unit and other speculation units sorted after the second speculation unit to cancel influence of the second speculation operation on the memory.
  • FIG. 3 is a schematic diagram of a speculation stack illustrated according to an embodiment of the invention.
  • the speculation stack 111 may record, for example, speculation units 310 , 320 and 330 respectively corresponding to different speculation operations.
  • the speculation units 310 and 320 are the first and second speculation units cited in the foregoing embodiments.
  • the speculation unit 330 corresponds to a speculation operation (hereinafter referred to as a third speculation operation) additionally occurred during the second speculation operation entering the speculation operation path to execute the second speculation instruction stream, but not limited thereto.
  • the first, second, and third speculation operations can be understood as corresponding to Speculation #1, Speculation #2 and Speculation #3 shown in FIG. 3 , respectively, but the invention is not limited thereto.
  • an instruction address 311 , a speculation start time 312 , a register status 313 , and a memory snapshot 314 in the speculation unit 310 can respectively be understood as the first start speculation time of the first speculation operation, the first branch instruction address of the first branch instruction, the first current register status and the first memory snapshot, but the invention is no limited thereto.
  • those skilled in the art should understand the meaning of each element in the speculation units 320 and 330 accordingly, which are not repeated hereinafter.
  • the execution model 11 may record the first start speculation time of the first speculation operation, the first branch instruction address of the first branch instruction, the first current register status and the first memory snapshot as the speculation unit 310 .
  • the speculation stack 111 is empty when a specific application is running on the normal instruction stream. In this case, it is not required to execute a memory access redirection but could directly access a processor memory of the physical machine 14 .
  • a top-of-stack speculation unit e.g., the speculation unit 330
  • the register status at the time of this speculation e.g., the third speculation operation
  • a register access is still executed on physical registers.
  • the memory access redirection to the memory snapshot of the top-of-stack speculation unit for the processor memory of the physical machine 14 is required.
  • the memory snapshot in the speculation unit can be understood as a current virtual memory.
  • the memory snapshot does not need to back up the entire physical memory, but only back up pages that have been modified since the first layer of speculation. If a page to be accessed is already stored in the memory snapshot, a memory access operation may directly read and write the memory snapshot. On the other hand, if the page to be accessed is not yet in the memory snapshot, the page is first added to the memory snapshot and copied from the physical memory to the memory snapshot, so then the memory snapshot may be read and written by the memory access operation.
  • the execution model 11 may add one speculation unit 310 on the top of the speculation stack 111 . If the second speculation operation is enforced to be executed again during the first speculation operation, the execution model 11 may add another speculation unit 320 on the top of the speculation stack 111 .
  • the memory snapshot 314 can be initialized to be empty. Then, assuming that during the first speculation operation, Page 1 and Page 2 are accessed by the instructions, the execution model 11 may add Page 1 and Page 2 to the memory snapshot 314 , and then read and write Page 1 and Page 2 .
  • the execution model 11 may add the speculation unit 320 on the top of the speculation stack 111 based on the above teaching.
  • the execution model 11 may copy the memory snapshot 314 of the speculation unit 310 to the memory snapshot 324 of the speculation unit 320 .
  • Page 3 and Page 4 are accessed by the instructions, the execution model 11 may add Page 3 and Page 4 to the memory snapshot 324 , and then read and write Page 3 and Page 4 .
  • the execution model 11 may add the speculation unit 330 on the top of the speculation stack 111 based on the above teaching.
  • the execution model 11 may copy the memory snapshot 324 of the speculation unit 320 to the memory snapshot 334 of the speculation unit 330 .
  • Page 1 and Page 5 are accessed by the instructions, the execution model 11 may add Page 5 to the memory snapshot 334 , and then read and write Page 1 and Page 5 .
  • the execution model 11 may retrieve one speculation unit in the stack according to the speculation end message provided by the processor model 12 . Specifically, if the branch instruction address that causes the speculation and the start speculation time included in the speculation end message provided by the processor model 12 match the branch instruction address and the start speculation time of one specific speculation unit in the stack, that specific speculation unit is “a unit that ends the speculation”. Then, the execution model 11 may restore the register status of the processor of the physical machine 14 to the register status stored in the unit that ends the speculation, thereby cancelling influence of the instructions executed in the speculation operation on the register. Also, the execution model 12 may discard the unit that ends the speculation and all the speculation units thereon.
  • the speculation unit at the top of the stack is changed to a previous speculation unit of the unit that ends the speculation.
  • discarding the speculation unit is equivalent to discarding influence of the instructions executed in the speculation operation on the memory.
  • the execution model 11 may restore the register status according to the speculation unit 320 , and discard the speculation unit 320 and the speculation unit 330 thereon, thereby discarding influence of the instructions executed in the second speculation operation on the memory.
  • the speculation unit at the top of the stack is changed to the speculation unit 310 , but the invention is not limited thereto.
  • the speculation stack 111 may be emptied. That is, influence of the instructions executed in the first, second, and third speculation operations on the memory will be discarded accordingly.
  • this predicted branch instruction is called a fake branch instruction.
  • the processor model 12 may mark a fake branch on the last instruction in the first fetch unit and send a speculation start message.
  • the execution model 11 may wait for a next fetch start message at the first branch prediction target address.
  • the execution model 11 may record an address of the last instruction in the last fetch unit in the instruction address of that speculation unit, but the invention is not limited thereto.
  • the execution model 11 may check whether instruction information of each instruction in the first fetch unit is sent to the processor model 12 . If so, it means that each instruction of the first fetch unit has been simulated, and related instruction information have been returned to the processor model 12 .
  • the execution model 11 may send the first fetch end message to the processor model 12 , and switch from the continued fetch state (i.e., the second continued fetch state) in the speculation operation path to the wait fetch state (i.e., the second wait fetch state) in the speculation operation path to wait for the next fetch start message.
  • the continued fetch state i.e., the second continued fetch state
  • the wait fetch state i.e., the second wait fetch state
  • the execution model 11 may switch from the wait fetch state (i.e., the second wait fetch state) in the speculation operation path to the wait fetch state (i.e., the first wait fetch state) in the normal operation path.
  • FIG. 4 is a schematic diagram of a simulation system interaction illustrated according to an embodiment of the invention.
  • the processor model 12 may simulate the target processor to execute the branch prediction on each branch instruction in one fetch unit, generate respective branch prediction information, and then simulate a fetch behavior of the target processor.
  • the processor model 12 may send a fetch start message 410 to the execution model 11 .
  • the execution model 12 may return an instruction information 420 (e.g., the correct execution result) of each branch instruction to the processor model 12 for the processor model 12 to determine whether to request the execution model 11 to enforce the JIT emulation engine 13 to execute the speculation operation.
  • the processor model 12 may send a speculation start message 430 to the execution model 11 .
  • whether to enforce the JIT emulation engine 13 to execute the speculation operation may also be determined by the execution model 11 .
  • the speculation start message 430 is not necessary. Instead, the processor model 12 may send the branch prediction information predicted and generated by the processor model 12 itself together with the fetch start message 410 to the execution model 11 for comparison by the execution model 11 , so as to determine whether to execute the speculation operation.
  • the execution model 11 may send a fetch end message 440 to the processor model 12 .
  • the processor model 12 may determine that the speculation operation needs to be ended at the decoding stage or a completion stage of the simulation pipeline 121 based on actual situation, accordingly send a speculation end message 450 , and flush the simulation pipeline 121 .
  • FIG. 5 is a schematic diagram of a state switching of the execution model illustrated according to an embodiment of the invention.
  • a control state machine of the execution model 11 may include 6 states as shown in FIG. 5 .
  • State A State B (i.e., the first wait fetch state) and State C (i.e., the first continued fetch state) appear on the normal operation path.
  • State D i.e., the second wait fetch state
  • State E i.e., the second continued fetch state
  • State F appear on the speculation operation path.
  • the transition between the states may be achieved by a control procedure of the execution model 11 .
  • the control procedure is executed before each instruction is executed.
  • the execution model 11 may stay at State A by default to consider the first branch instruction of the specific application. In this case, the execution model 11 may send a start point of the specific application to the processor model 12 and then switch to State B. Then, the execution model 11 may switch between State B to State F based on actual situation.
  • the control procedure on the execution model 11 may include two stages (i.e., the code is divided into two parts), which may be respectively understood as completing the fetching of a previous instruction and waiting for the fetching of the current instruction.
  • the execution model 11 may obtain an execution result of the previous instruction from the JIT emulation engine 13 , which is then sent together with the static information of the previous instruction stored in the execution model 11 as the instruction information (e.g., the instruction information 420 of FIG. 4 ) to the processor model 12 .
  • the execution model 11 executes a state switching. If the previous instruction is a branch instruction, the execution model 11 stays at State C and wait for the processor model 12 to inform of whether to execute the speculation and whether to continue fetching the current fetch unit.
  • the processor model 12 compares whether a branch direction and a branch target address provided by the JIT emulation engine 13 are consistent with a branch direction and a branch target address predicted by the processor model 12 . If the result of the JIT emulation engine 13 is consistent with the branch prediction result (i.e., the branch prediction is correct), the processor model 12 does not start the speculation. Further, if the branch direction is the branch taken, the fetching is stopped (i.e., switching from State C to State B). Otherwise, if the branch direction is the branch not-taken, the fetching is continued (i.e., maintaining at State C).
  • the processor model 12 may start the speculation. In this case, if the prediction direction is the branch taken, the fetching is stopped (i.e., switching from State C to State D). Otherwise, if the branch direction is the branch not-taken, the fetching is continued (i.e., switching from State C to State E). In this embodiment, if the execution model 11 is already on the speculation operation path, regardless of whether the speculation occurs again or not, the execution model 11 will constantly stay on the speculation operation path until the processor model 12 sends the speculation end message 450 . In addition, if the direction of a branch (i.e., the second branch instruction) encountered again on the speculation path is the branch taken, the execution model 11 may stop fetching (i.e., switching from State E to State D).
  • the execution model 11 After sending the instruction information of the previous instruction to the processor model 12 , the execution model 11 further checks related instruction information of each instruction in the currently considered fetch unit has been passed to the processor model 12 . If the fetch unit has unit has been completely passed, the execution model 11 may enter the second wait fetch state (e.g., switching from State C to State B, or switching from State E to State D). In general, the fetch end message 440 of FIG. 4 may be sent when the execution model 11 switches from State C to State B, or from State C to State D, or from State E to State D, and may include two situations: the fetching of the current fetch unit is ended or the fetching is ended due to the branch taken.
  • the fetch end message 440 of FIG. 4 may be sent when the execution model 11 switches from State C to State B, or from State C to State D, or from State E to State D, and may include two situations: the fetching of the current fetch unit is ended or the fetching is ended due to the branch taken.
  • the procedure In the second stage of the control procedure, if the control state machine enters the wait fetch state (States B and D), the procedure will stay at the second stage to wait for the message from the processor model 12 . If the processor model 12 passes the fetch start message, the continued fetch state will be re-entered (e.g., switching from State B to State C or switching from State D to State E).
  • the execution model 11 may return to the first wait fetch state on the normal operation path (i.e., switching from State D to State B). If the processor model 12 passes the speculation end message 450 but the execution model 11 has not yet emptied the speculation stack 111 (i.e., there are still speculation instructions not completely executed on the simulation pipeline 121 ), the execution model 11 may stay at the second wait fetch state (i.e., State D).
  • the JIT emulation engine 13 cannot track sub procedure that requires a privilege mode such as a system call, influence of the system call on the system cannot be cancelled. Therefore, if the system call is encountered on the speculation operation path, the execution model 11 should block the instruction execution until the processor model 12 informs the execution model 11 that the speculation is ended (i.e., switching from State E to State F, and then switching from State F to State B or State D).
  • the instruction in the speculation operation may exceed a scope of executable instructions. If the instruction is enforced outside the scope of the executable instructions, an incorrect instruction encoding may be encountered, causing the JIT emulation engine 13 to crash. Therefore, if a situation where the instruction is outside the scope of the executable instructions is encountered on the speculation operation path, the execution model 11 should also block the instruction execution until the processor model 12 informs the execution model 11 that the speculation is ended (i.e., switching from State E to State F, and then switching from State F to State B or State D).
  • FIG. 6 is a timing diagram of a state switching of the execution model illustrated according to FIG. 5 .
  • the processor model 12 is simulating and executing “fetch” of a fetch unit, but the invention is not limited thereto.
  • the execution model 11 may execute the control procedure of the state switching of FIG. 5 to switch from State A to State B. Then, the execution model 11 may switch again from State B to State C to continue fetching. Then, the execution model 11 may control the JIT emulation engine 13 to execute the first instruction (i.e., the JIT emulation engine 13 controls the physical machine 14 to execute the first instruction).
  • the execution model 11 may execute the control procedure in the following manner. First, the instruction information 420 of the first instruction is obtained in the first stage of the control procedure and transmitted to the processor model 12 ; then, the state switching is executed in the second stage of the control procedure. For instance, it is assumed that the first instruction is the last instruction of one fetch unit or the first instruction is the branch taken, the execution model 11 switches from State C to State B at the time point 620 , and switches from State B to State C again if a next fetch start message is received. For instance, it is assumed that the first instruction is not the last instruction of one fetch unit and is the branch not-taken, the execution model 11 continues to stay at State C. Next, the execution model 11 may control the JIT emulation engine 13 to execute the second instruction.
  • the execution model 11 may execute the control procedure in the following manner. First, the instruction information 420 of the second instruction is obtained in the first stage of the control procedure and transmitted to the processor model 12 ; then, the state switching is executed in the second stage of the control procedure. For instance, it is assumed that the second instruction is the branch instruction, the branch prediction is incorrect (i.e., the speculation operation is started) and there is the branch not-taken, the execution model 11 switches from State C to State E at the time point 630 ; then, the execution model 111 maintains at State E (or can be understood as switching from State E to the same State E). Next, the execution model 11 may control the JIT emulation engine 13 to execute the third instruction.
  • the invention provides a simulation method and a simulation system, which can be implemented with a JIT-based emulation engine.
  • the simulation system of the invention can be divided into an execution model and a processor model based on JIT emulation engine.
  • the execution model can call the JIT emulation engine to execute instructions, and obtain influence of the instructions on an architectural status of a processor.
  • the processor model can simulate an internal process of a target processor and determine whether to start and end a speculation.
  • the execution model and the processor model can interact through a specific protocol.
  • the simulation method of the invention may store an application running scene when the speculation is started, and redirect influence of speculation instructions on a memory to a memory snapshot.
  • the simulation method of the invention may also restore the application running scene to a status before the speculation is started, and cancel influence of the speculation instructions on the memory.
  • the JIT emulation engine can also accurately model and simulate the speculation execution. In this way, related processor hardware designers can optimize the record of speculation occurred in the processor architecture and influence of the speculative execution on the processor performance based on the relevant results of the speculation execution.
  • the simulation method and the simulation system provided by the invention can also help related software designers to optimize the performance of the software.
  • this processor vendor may provide the simulation system of the invention (including the execution model and the processor model that simulates the behavior of the processor A) as an accessory like a software development kit (SDK or other similar form) to the customer.
  • SDK software development kit
  • the customer may further optimize the developed software based on the simulated speculation results provided by the processor model after running the developed software with the JIT emulation engine.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)
US17/079,530 2020-02-10 2020-10-26 Simulation method and simulation system Active 2040-12-30 US11442757B2 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010084241.4 2020-02-10
CN202010084241.4A CN111324948B (zh) 2020-02-10 2020-02-10 模拟方法及模拟系统

Publications (2)

Publication Number Publication Date
US20210247991A1 US20210247991A1 (en) 2021-08-12
US11442757B2 true US11442757B2 (en) 2022-09-13

Family

ID=71172668

Family Applications (1)

Application Number Title Priority Date Filing Date
US17/079,530 Active 2040-12-30 US11442757B2 (en) 2020-02-10 2020-10-26 Simulation method and simulation system

Country Status (2)

Country Link
US (1) US11442757B2 (zh)
CN (1) CN111324948B (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115421862B (zh) * 2022-09-14 2023-09-26 北京计算机技术及应用研究所 一种51单片机处理器指令集虚拟化仿真方法
CN117909160A (zh) * 2024-03-19 2024-04-19 华中科技大学 基于物联网的固件崩溃分析方法及装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7047394B1 (en) * 1999-01-28 2006-05-16 Ati International Srl Computer for execution of RISC and CISC instruction sets
US20100057427A1 (en) * 2008-09-04 2010-03-04 Anthony Dean Walker Simulated processor execution using branch override

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5634103A (en) * 1995-11-09 1997-05-27 International Business Machines Corporation Method and system for minimizing branch misprediction penalties within a processor
JP3292189B2 (ja) * 1999-11-17 2002-06-17 日本電気株式会社 プロセッサ性能データ収集装置及び該装置を利用した最適化方法
US20010051861A1 (en) * 2000-06-09 2001-12-13 Fujitsu Limited Method and apparatus for simulation, and a computer product
JP2008176453A (ja) * 2007-01-17 2008-07-31 Nec Electronics Corp シミュレーション装置
US8352229B1 (en) * 2009-01-26 2013-01-08 Xilinx, Inc. Reloadable just-in-time compilation simulation engine for high level modeling systems
JP5278624B2 (ja) * 2010-10-12 2013-09-04 富士通株式会社 シミュレーション装置，方法，およびプログラム
CN102360282A (zh) * 2011-09-26 2012-02-22 杭州中天微系统有限公司 快速处置分支指令预测错误的流水线处理器装置
JP5961971B2 (ja) * 2011-10-12 2016-08-03 富士通株式会社 シミュレーション装置，方法，およびプログラム
CN102841857B (zh) * 2012-07-25 2015-02-25 龙芯中科技术有限公司 缓存预测执行的处理器与装置及方法
CN103699427B (zh) * 2013-12-13 2018-01-16 华为技术有限公司 一种基于jit仿真器的中断检测方法及系统
CN105094949B (zh) * 2015-08-06 2018-04-17 复旦大学 一种基于指令计算模型与反馈补偿的模拟方法与系统
US9996439B2 (en) * 2015-09-23 2018-06-12 Qualcomm Incorporated Self-error injection technique for point-to-point interconnect to increase test coverage
US10013255B2 (en) * 2015-11-01 2018-07-03 Centipede Semi Ltd. Hardware-based run-time mitigation of conditional branches
CN107783817A (zh) * 2016-08-31 2018-03-09 杭州华为数字技术有限公司 处理器的模拟方法、功能模拟器、性能模拟器和模拟系统
CN107688468B (zh) * 2016-12-23 2020-05-15 北京国睿中数科技股份有限公司 推测执行处理器中分支指令与分支预测功能的验证方法
WO2018149495A1 (en) * 2017-02-16 2018-08-23 Huawei Technologies Co., Ltd. A method and system to fetch multicore instruction traces from a virtual platform emulator to a performance simulation model
CN109032879B (zh) * 2017-06-09 2021-08-20 展讯通信（上海）有限公司 多核处理器访存数据检测验证系统及方法
CN110069285B (zh) * 2019-04-30 2021-06-01 成都海光微电子技术有限公司 一种检测分支预测的方法及处理器

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7047394B1 (en) * 1999-01-28 2006-05-16 Ati International Srl Computer for execution of RISC and CISC instruction sets
US20100057427A1 (en) * 2008-09-04 2010-03-04 Anthony Dean Walker Simulated processor execution using branch override

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
Derek Chiou et al., FPGA-Accelerated Simulation Technologies (FAST): Fast, Full-System, Cycle-Accurate Simulators, 2007 IEEE, [Retrieved on Dec. 16, 2021]. Retrieved from the internet: <URL: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=4408260> 13 Pages (249-261) (Year: 2007). *
Martin Schoeberl, A Time-predictable Branch Predictor, Apr. 8-12, 2019, [Retrieved on Dec. 20, 2022]. Retrieved from the internet: <URL: https://dl.acm.org/doi/pdf/10.1145/3297280.3297337> 10 Pages (607-616) (Year: 2019). *
Pablo Montesinos Ortego, SESC: SuperESCalar Simulator, Dec. 20, 2004, [Retrieved on Dec. 20, 2022]. Retrieved from the internet: <URL: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.162.2439&rep=rep1&type=pdf> 22 Pages (1-22) (Year: 2004). *

Also Published As

Publication number Publication date
CN111324948A (zh) 2020-06-23
CN111324948B (zh) 2023-04-25
US20210247991A1 (en) 2021-08-12

Similar Documents

Publication Publication Date Title
EP3507698B1 (en) Program tracing for time travel debugging and analysis
US10031834B2 (en) Cache-based tracing for time travel debugging and analysis
US8855994B2 (en) Method to simulate a digital system
US11995440B2 (en) Method and system for executing new instructions
US11803383B2 (en) Method and system for executing new instructions
US11669328B2 (en) Method and system for converting instructions
US20220206809A1 (en) Method and system for executing new instructions
JP5356531B2 (ja) シーケンス検出又は命令に関連付けられた情報に基づいた命令の最適化性能
US11604643B2 (en) System for executing new instructions and method for executing new instructions
EP3662372B1 (en) Tentative execution of code in a debugger
US11625247B2 (en) System for executing new instructions and method for executing new instructions
US11442757B2 (en) Simulation method and simulation system
EP3539000B1 (en) Cache-based tracing for time travel debugging and analysis
US8108843B2 (en) Hybrid mechanism for more efficient emulation and method therefor
CN110892384A (zh) 对处理器未定义行为依赖的重放时间行程跟踪
US20140316761A1 (en) Simulation apparatus and storage medium
US20160196156A1 (en) Simulation apparatus, simulation method, and computer product
US11789736B2 (en) Method and system for executing new instructions
US20240028336A1 (en) Techniques for reducing cpu privilege boundary crossings
Sun et al. Using execution graphs to model a prefetch and write buffers and its application to the Bostan MPPA
US6430682B1 (en) Reliable branch predictions for real-time applications
Jebali et al. Ensuring consistency between cycle-accurate and instruction set simulators
Hindborg Accelerating Instruction Set Emulation using Reconfigurable Hardware and Trace Based Optimization
CN114428638A (zh) 指令发射单元、指令执行单元、相关装置和方法

Legal Events

Date Code Title Description
FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

AS Assignment

Owner name: SHANGHAI ZHAOXIN SEMICONDUCTOR CO., LTD., CHINA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:WANG, JUNSHI;WANG, MENG;WANG, ZHENG;REEL/FRAME:054171/0185

Effective date: 20201020

STPP Information on status: patent application and granting procedure in general

Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT RECEIVED

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED

STCF Information on status: patent grant

Free format text: PATENTED CASE